Data protection
Plain-language summaries first. These are placeholders — replace with counsel-reviewed text before launch.
See also the legal overview, our security practices and the data processing agreement.
Summary. For the conversations you route through the platform we act as a processor — we handle that data on your documented instructions. For your own account, billing and support records we act as a controller. Which role applies changes who owes which duties, so it is stated explicitly in the DPA.
Full text: [Insert counsel-reviewed controller/processor analysis, including joint-controller scenarios if any.]
Summary. Where the GDPR applies, our DPA is intended to carry the Article 28 terms, and personal data leaving the EEA is intended to travel under the Standard Contractual Clauses. The UK Addendum covers UK transfers.
Full text: [Insert Article 28 terms, legal bases table, transfer impact assessment summary, and the supervisory authority and EU representative under Article 27.]
Summary. We do not sell personal information and we do not share it for cross-context behavioural advertising. Where we handle personal information for a customer we intend to act as a service provider under the CPRA.
Full text: [Insert CPRA service-provider terms, consumer rights request process and verification method.]
Summary. Healthcare teams use the platform for administrative conversations. Any use involving protected health information needs a signed Business Associate Agreement in place first, and a configured boundary so clinical questions route to a person.
HIPAA support is available only on the Enterprise plan, with a signed Business Associate Agreement. It is not available on Free, Starter, Growth or Scale.
Full text: [Insert the agreed scope of PHI processing under the Enterprise BAA.]
Summary. We use a small set of infrastructure and model providers to run the service. The DPA commits us to keeping a current list and giving notice before a new sub-processor starts processing customer data.
Current list (last updated October 9, 2026). All customer data is hosted in the United States. Aftersales does not currently offer hosting in other regions.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, compute and file storage | All customer data, including conversations and attachments | United States |
| Supabase, Inc. | Managed database and authentication | Account data, conversation data and metadata | United States |
| Vercel Inc. | Hosting of the web app, website and chat widget; content delivery | Request data (IP address, browser data) and data passing through the app | United States (global edge network) |
| Anthropic, PBC | AI model inference for the Agent and Copilot | Conversation content, knowledge content and instructions sent with each AI request | United States |
| Resend | Transactional and conversation email delivery | Email addresses, names and email content | United States |
| Stripe, Inc. | Payment processing and billing | Customer billing contact and payment details (not end-user conversation data) | United States |
Transfers. Personal data from the EEA, UK or Switzerland is transferred to the United States. These transfers rely on the EU Standard Contractual Clauses (with the UK Addendum and Swiss amendments) in our DPA with customers and in our agreements with each sub-processor, and on the EU–US Data Privacy Framework where a provider is certified.
AI training. Our agreement with Anthropic does not permit customer data sent through the API to be used to train its models.
Changes. We will update this list and notify customers at least 30 days before a new sub-processor begins processing customer personal data, as set out in section 6 of our DPA. To receive notices, email privacy@aftersales.co.
Summary. Where data crosses a border we rely on an approved transfer mechanism rather than consent.
Customer data is hosted and processed in the United States. Transfers from the EEA, UK and Switzerland rely on the EU Standard Contractual Clauses, the UK Addendum and Swiss amendments, and on the EU–US Data Privacy Framework where the recipient is certified. See the sub-processor list for each provider.
Summary. Conversation data stays available while your account is active and is deleted on a defined schedule after you close it or ask us to remove it. You can export your data at any time.
Retention schedule: [Insert the actual retention periods per data category, backup retention, and the deletion SLA after an erasure request.]
Summary. If you are an end customer of one of our customers, the fastest route is to contact them directly — they control that data and we act on their instructions. If you are our direct customer, or you cannot identify who holds your data, write to us and we will route it.
Requests: privacy@aftersales.co. [Add the DPO or privacy contact name, postal address, and the response-time commitment.]
Last updated: September 2026 · Questions: privacy@aftersales.co